org.osgi.service.useradmin
Interface Group

Whether or not a given Authorization context implies a Group
object depends on the members of that Group object.

A Group object can have two kinds of members: basic and
required . A Group object is implied by an
Authorization context if all of its required members are implied and
at least one of its basic members is implied.

A Group object must contain at least one basic member in order to be
implied. In other words, a Group object without any basic member
roles is never implied by any Authorization context.

A User object always implies itself.

No loop detection is performed when adding members to Group objects,
which means that it is possible to create circular implications. Loop
detection is instead done when roles are checked. The semantics is that if a
role depends on itself (i.e., there is an implication loop), the role is not
implied.

The rule that a Group object must have at least one basic member to
be implied is motivated by the following example:

group foo
required members: marketing
basic members: alice, bob

Privileged operations that require membership in "foo" can be performed only
by "alice" and "bob", who are in marketing.

If "alice" and "bob" ever transfer to a different department, anybody in
marketing will be able to assume the "foo" role, which certainly must be
prevented. Requiring that "foo" (or any Group object for that matter)
must have at least one basic member accomplishes that.

However, this would make it impossible for a Group object to be
implied by just its required members. An example where this implication might
be useful is the following declaration: "Any citizen who is an adult is
allowed to vote." An intuitive configuration of "voter" would be:

group voter
required members: citizen, adult
basic members:

However, according to the above rule, the "voter" role could never be assumed
by anybody, since it lacks any basic members. In order to address this issue
a predefined role named "user.anyone" can be specified, which is always
implied. The desired implication of the "voter" group can then be achieved by
specifying "user.anyone" as its basic member, as follows: